ClawHub
Back to skill

Security audit

benchmarking-instagram-influencer-engagement

Security checks for vulnerabilities and agentic risk

Overview

The skill mostly matches its Instagram benchmarking purpose, but it needs review because it sends targets to Apify, exposes an API token in a URL-based curl example, and documents broader scraping options than the stated account-benchmarking use case.

Review before installing. Use it only for targets you are comfortable sending to Apify, avoid the URL-token curl fallback unless revised to use an authorization header, and constrain runs to account handles and reasonable post limits unless you intentionally need the broader scraper features.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:93
Finding

Apify API Token Exposed in Request URL

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 93–98
Vulnerability Type: API credential exposure through a URL query parameter
Risk Level: Medium

Vulnerable Code

bash
curl -X POST \
  "https://api.apify.com/v2/acts/apidojo~instagram-scraper/runs?token=$APIFY_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "usernames": ["[handle1]", "[handle2]"],
    "maxItems": 30
  }'

Technical Analysis

The documented REST fallback expands APIFY_TOKEN directly into the request URL. Although HTTPS protects the URL while it is in transit, the expanded credential may remain visible in the curl process arguments and may be recorded by shell diagnostics, command auditing, HTTP client traces, proxies, monitoring systems, or other infrastructure that logs complete URLs.

Consequently, users who follow the Skill instructions may unintentionally disclose a reusable authentication credential. The issue is limited to the token's configured Apify privileges; the audit did not establish that it grants broader system access.

Attack Path

  1. A user exports a valid APIFY_TOKEN and runs the documented REST fallback command.
  2. The shell expands $APIFY_TOKEN into the URL passed to curl.
  3. An attacker with access to local process information or a system that captures complete request URLs obtains the expanded token.
  4. The attacker submits authenticated requests to Apify using the stolen token.
  5. The attacker can perform actions permitted by that token until it is revoked, rotated, or expires.

Impact Assessment

Successful exploitation can permit unauthorized use of the victim's Apify account within the token's assigned privileges. Potential effects include running actors, consuming paid platform resources, accessing API-visible data available to the token, and causing financial or operational impact. The exact scope depends on the permissions and account resources associat ...[truncated 26 chars]

Remediation
View remediation

Remediation Suggestions

  • Use Apify's supported HTTP authorization header instead of placing the token in the query string. For example:

    bash
    curl -X POST \
  "https://api.apify.com/v2/acts/apidojo~instagram-scraper/runs" \
  -H "Authorization: Bearer $APIFY_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "usernames": ["[handle1]", "[handle2]"],
    "maxItems": 30
  }'

  • Confirm the precise authorization-header syntax against the current Apify API documentation before publishing the revised command.

  • Ensure command output, debug traces, and HTTP headers are not logged when they may contain credentials.

  • Keep .env files outside version control, apply restrictive filesystem permissions, and provide a safe .env.example containing placeholders only.

  • Grant the token only the minimum privileges needed for actor execution and dataset retrieval.

  • Rotate the token immediately if the vulnerable command has been executed in an environment where process arguments or URLs may have been retained.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (4)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The skill description does not warn that supplied Instagram handles, analysis targets, and resulting scraped data are transmitted to Apify, a third-party external service. This creates a transparency and consent problem, especially where account lists, competitive intelligence, or campaign vetting data may be sensitive business information.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The skill is presented as an Instagram account benchmarking tool, but its documented inputs permit broader scraping targets such as hashtags, locations, audio pages, and reels, plus an arbitrary JavaScript customMapFunction. This mismatch expands the data collection and transformation surface beyond the stated purpose, increasing the risk of misuse, overcollection, and user surprise about what is actually being sent to the external service.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
89% confidence
Finding

The skill explicitly instructs sending request data to Apify's external API, which means usernames and analysis parameters leave the local environment and are processed by a third party. While external API use is core to the skill's function, it is still a real data egress vector that can expose sensitive business context or target lists if not disclosed and controlled.

Content

Scanner excerpt · SKILL.md (reported line 93)May include surrounding context.

REST API fallback:

bash
curl -X POST \
  "https://api.apify.com/v2/acts/apidojo~instagram-scraper/runs?token=$APIFY_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{

External Transmission

Medium
Category
Data Exfiltration
Confidence
88% confidence
Finding

The hardcoded Apify API endpoint confirms outbound transmission to a third-party service. In this context that is expected behavior, but it remains security-relevant because it creates dependency on an external processor and may disclose user-supplied target identities and scraped results outside the immediate system boundary.

Content

Scanner excerpt · SKILL.md (reported line 94)May include surrounding context.

REST API fallback:

bash
curl -X POST \
  "https://api.apify.com/v2/acts/apidojo~instagram-scraper/runs?token=$APIFY_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "usernames": ["[handle1]", "[handle2]"],